This is a follow-up to the https://bugs.webkit.org/show_bug.cgi?id=106891 fix, which was not quite correct. Now we do the array index check according to the ECMAScript 5, section 15.4: "A property name P (in the form of a String value) is an array index if and only if ToString(ToUint32(P)) is equal to P and ToUint32(P) is not equal to 2^32-1." Patch to follow.
Created attachment 182949 [details] Patch
Comment on attachment 182949 [details] Patch Clearing flags on attachment: 182949 Committed r139887: <http://trac.webkit.org/changeset/139887>
All reviewed patches have been landed. Closing bug.